topic Re: Query format for viewing server name with count on respect of color in Getting Data In

Query format for viewing server name with count on respect of color

sushil_sh — Sat, 31 Jul 2021 11:35:07 GMT

Hi Team,

I am very new in Splunk and i need your help to change my query as per requirement

Please validate my syantax as per requirement How do we get list of server name with count(which is change color like grey or Uninitialized) instead of count of server (server name comes under ServerName)

Please find my syntax and result

sourcetype=ABC Category IN ("Support","Patch") HealthValue IN(Grey, Uninitialized,) | bin _time span=1d | dedup ServerName HealthValue _time | timechart count(ServerName) as "QTY Servers" by HealthValue

i am waiting for quick response

Re: Query format for viewing server name with count on respect of color

ITWhisperer — Sat, 31 Jul 2021 12:01:56 GMT

sourcetype=ABC Category IN ("Support","Patch") HealthValue IN(Grey, Uninitialized,) | bin _time span=1d | dedup ServerName HealthValue _time | stats values(ServerName) as "Servers" by HealthValue _time

Re: Query format for viewing server name with count on respect of color

sushil_sh — Sat, 31 Jul 2021 12:39:13 GMT

Thanks for your response

@ITWhisperer how do we get clour cout on the refference of server name

Eg:- suppose one server change color 3 time in time _time then how do i express this query in syntax

like below

Server	Colour	Count	Time
xyz	Grey	3	1:00

Thanks in advance

Re: Query format for viewing server name with count on respect of color

ITWhisperer — Sat, 31 Jul 2021 13:02:27 GMT

sourcetype=ABC Category IN ("Support","Patch") HealthValue IN(Grey, Uninitialized,) | bin _time span=1d | stats count by ServerName HealthValue _time